Technical Tip: VPN IPSEC DIAL UP does not work with the same DH groups

[HarveyRebelo]

Description

This article describes the behavior and how to fix a VPN IPSEC dial-up connection issue with FortiClient (Free and Paid Version)

Scope

FortiGate v7, v7.2, v7.4, FortiClient 7.2.9 and 7.4.

Solution

1. After Configure VPN IPSEC Dial-up successfully, and setting the same DH Groups on FortiClient, the negotiation fails:

2. To mitigate this issue, specify only one DH group on VPN IPSEC configuration on FortiGate (it does not matter if uses DH 14 or 5 group, any should work).

Note:

Certain versions of FortiOS and FortiClient may have different default DH group/s enabled, so it is important to check the configuration, not just leave with default settings, and match the enabled DH group/s both in phase-1 and phase-2 settings.

Related articles:
Troubleshooting Tip: Dial-up IPsec VPN in aggressive mode when more than one DH Group is selected

Technical Tip: Generate DH public value request pending and compute DH shared secret request pending...